OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
BENCHMARK() is not the only way to determine successfull MySQL injection

From: Philip Stoev (philipstoev.org)
Date: Tue Jul 06 2004 - 05:16:15 CDT

Hello,

As far as the timing attack using BENCHMARK() is concerned, the same effect
can be achieved as follows:

1. Inject GET_LOCK(1, 60);
(this injection will return immediately regardless of success)

2. Inject GET_LOCK(1, 5);
(if successfull, this injection will return in 5 seconds rather than
immediately)

This method provides exact delays independent of CPU speed, does not load
the processor and does not require selecting an appropriate expression to
BENCHMARK().

Philip Stoev

> Whitepaper
> **********
>
> We have written a paper that accompanies this advisory. The paper
> provides details of various MySQL lockdown techniques, and a review of
> common attacks on MySQL, including SQL injection. The paper can be found
> at
>
> http://www.ngssoftware.com/papers/HackproofingMySQL.pdf

----------------------------------------
My Inbox is protected by SPAMfighter
14126 spam mails have been blocked so far.
Download free www.spamfighter.com today!